Strategic IT Security & GRC Leader

HS2 (High Speed Two) Ltd; Birmingham; Hybrid; GBP 59,000 - 72,000; Full time

Benefits offered by this job

Flexible benefits fund 20%

Flexible working

Personal and professional development

Job summary

HS2 Ltd is seeking a Principal IT Security Manager (GRC) to lead governance, risk and compliance within the Information & Cyber Security function. You will shape enterprise-wide security policies, manage third-party risk and oversee testing and assurance activities to protect critical systems.

The role requires translating business goals into security requirements, collaborating with legal, procurement and IT teams, and delivering executive risk reporting.

Qualifications

• Experience with governance, risk and compliance within information security.
• Ability to translate business goals into cyber governance requirements.
• Knowledge of NCSC standards and Cabinet Office requirements.
• Experience with third‑party risk management and supplier contracts.
• Experience with security testing and assurance strategies.
• Experience with risk management and audit remediation.

Responsibilities

• Direct the development, implementation and maintaining organisation wide cybersecurity governance frameworks.
• Own the enterprise wide Information & Cyber Security policy lifecycle, ensuring regular review, approval, and publication of security policies.
• Defining, managing and maintaining security policies, standards, procedures and controls aligned with regulatory requirements.
• Translate business goals into cyber governance requirements and embed into third-party and internal delivery frameworks.
• Oversee the provision of security testing and assurance strategy and capability, including penetration testing and simulation exercises.
• Own the information and cyber risk register and track mitigation progress.
• Set direction for enterprise-wide risk assessment methodologies and ensure integration with corporate risk processes.
• Lead the third-party risk management program, including vendor due diligence and ongoing monitoring.
• Work with procurement, legal, and IT to embed security clauses in supplier contracts.
• Maintain a risk profile for critical suppliers and support risk treatment or exit strategies.
• Ensure ongoing compliance with cybersecurity-related legal, regulatory, and contractual obligations.
• Manage responses to audits and reporting of KRIs.

Skills

Governance

Governance & Assurance

Problem definition

Stakeholder communication

Team management

GRC knowledge

Cybersecurity frameworks

Security testing

Public sector standards

Job description

HS2 Ltd is seeking a Principal IT Security Manager (GRC) to lead governance, risk and compliance within the Information & Cyber Security function. You will shape enterprise-wide security policies, manage third-party risk and oversee testing and assurance activities to protect critical systems.

The role requires translating business goals into security requirements, collaborating with legal, procurement and IT teams, and delivering executive risk reporting.